Open Source

Ruby on Rails Patches Up SQL Injection Vulnerabilities

The open-source Ruby on Rails web development framework has been in the spotlight this month after two SQL injection vulnerabilities were found, and subsequently patched.

The team blog meanwhile concentrates on an announcement that the security patches introduced a regression on the PostgreSQL Range feature. This regression was only introduced to Rails 4.x. Rails 3.2 users are not impacted.

The team writes, "Rails 3.2.19, 4.0.7, and 4.1.3 have been released! These three releases contain important security fixes, so please upgrade as soon as possible! In order to make upgrading as smooth as possible, we've only included commits directly related to each security issue."

Although the vulnerabilities impact differing versions, the two flaws share a common DNA in some way and are in fact related. In terms of how they manifest themselves, both allow malicious attackers to insert arbitrary SQL code into queries using specially crafted values.

According to the Ruby on Rails team, "The only feasible workaround for this issue is to not allow user-controlled values to be used in queries with the affected data types. Given the difficulty of ensuring this, upgrading is strongly advised."

Dr. Dobb's encourages readers to engage in spirited, healthy debate, including taking us to task.
However, Dr. Dobb's moderates all comments posted to our site, and reserves the right to modify or remove any content that it determines to be derogatory, offensive, inflammatory, vulgar, irrelevant/off-topic, racist or obvious marketing or spam. Dr. Dobb's further reserves the right to disable the profile of any commenter participating in said activities.

Video

This month's Dr. Dobb's Journal

This month,
Dr. Dobb's Journal is devoted to mobile programming. We introduce you to Apple's new Swift programming language, discuss the perils of being the third-most-popular mobile platform, revisit SQLite on Android
, and much more!